Splunk Search

How to achieve conditional formatting of values with eval if and regex?

erikschubert
Engager

Hello everyone,

I have the following field and example value: sourcePort=514.000

I'd like to format these fields in such a way, that only the first digits until the point are kept. Furthermore, this should only apply to a certain group of events (group one). 
Basically: 
before: sourcePort=514.000
after:    sourcePort=514


What I have until now:
search...
| eval sourcePort=if(group=one, regex part, sourcePort)

The regex to match only the digits is  ^\d{1,5}
However, I am unsure how to work with the regex and if it is even possible to achieve my goal using this.


Thanks in advance

Labels (4)
0 Karma

tpickle
Splunk Employee
Splunk Employee

I would use split and mvindex instead of rex:

| eval sourcePort=if(group=one,mvindex(split(sourcePort,"."),0),sourcePort)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You can use | rex to achieve that:

|rex field=sourcePort "(?<src_port>\d{1,5})"
|eval sourcePort=if(group=one,src_port,sourcePort)

 

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can use the replace function (which supports regex)

| eval sourcePort=if(group=one,replace(sourcePort,"(?<p>\d{1,5})\.(?<q>.*)","\1"),sourcePort)
0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Community Content Calendar, August edition

In the dynamic world of cybersecurity, staying ahead means constantly solving new puzzles and optimizing your ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...